Cybersecurity Compliance (CMMC Level 2 Implementation)

The contract requires the implementation and ongoing maintenance of Cybersecurity Maturity Model Certification (CMMC) Level 2 controls to safeguard Covered Defense Information (CDI) in accordance with DFARS 252.204-7012 and the security requirements outlined in NIST SP 800-171. This subcontract is part of a broader effort by the Defense Logistics Agency within the Department of Defense to ensure robust cybersecurity protections across its supply chain, with compliance mandatory for handling sensitive unclassified information. The obligated party must establish, document, and sustain technical and organizational safeguards aligning with CMMC Level 2 standards, including access control, awareness training, incident response, and system integrity measures, all while continuously monitoring and adapting to evolving threats. The performance of this contract is tied to the defense industrial base and applies to any entity handling CDI on behalf of the government, regardless of geographic location. The solicitation date indicates this requirement is being actively pursued for implementation in 2026, and while specific performance locations are not provided, the scope is universally applicable to all systems and networks supporting covered defense activities. As a subcontract under NAICS code 541512, the work involves professional, scientific, and technical services focused on cybersecurity operations, and failure to meet CMMC Level 2 compliance will result in non-conformance and potential termination of contractual obligations. The responsibility lies entirely with the contractor to achieve, validate, and sustain certification through third-party assessment.